Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2024-49825

IBM Robotic Process Automation session fixation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ibm

Description

IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

IBM Robotic Process Automation

Default version status: unaffected

  • 21.0.0 to ≤ 21.0.7.20affected
  • 23.0.0 to ≤ 23.0.20affected

IBM Robotic Process Automation for Cloud Pak

Default version status: unaffected

  • 21.0.0 to ≤ 21.0.7.20affected
  • 23.0.0 to ≤ 23.0.20affected

References